AI Root Cause Analysis: From Alerts to Explained Incidents

When something breaks, the hardest part is rarely the fix. It is the hours spent reading dashboards, scrolling logs, checking what changed, and reconstructing the timeline before anyone can say what happened. AI root cause analysis puts an agent on that assembly work: it reads across every source, correlates, ranks hypotheses with evidence, and drafts the write-up, so engineers spend their time confirming and fixing. This guide covers how it works, what it needs, and how to start, connecting to AI incident response checklist and the ITSM context in the agentic ITSM whitepaper.

How does the agent work?

Step	Action	Source
Scope	Identify the incident window, affected services, and symptoms from the alert or ticket	Alerting, ticketing
Gather	Pull logs, traces, metrics, and errors for affected services and their dependencies	Observability stack
Changes	List deployments, configuration changes, feature flags, and infrastructure changes in the window	CI/CD, change management, cloud audit logs
Correlate	Align anomalies with changes and dependency paths in time	Topology map
Hypothesize	Produce ranked candidate causes with supporting and contradicting evidence	Reasoning over the gathered set
Draft	Timeline, hypotheses, evidence links, suggested next checks	Postmortem template
Confirm	Engineer reviews, runs the suggested checks, confirms or redirects	Human

Access is read-only; the agent proposes, the engineer confirms.

Why are change records the key source?

Most production incidents follow a change: a deployment, a configuration edit, a flag flip, a dependency update, a certificate expiry, a scaling event. An agent that lists every change in the window and correlates it with the first anomaly finds the likely cause quickly. Organizations with poor change records get less from the agent, and the gap becomes visible, which is its own useful finding.

How are hypotheses presented?

Rank	Hypothesis	Evidence for	Evidence against	Suggested check
1	Deployment of service X at 14:02 introduced a query regression	Latency on X rose at 14:03; slow query logs show new pattern; downstream timeouts follow	No error rate change on X	Compare query plans; roll back in staging
2	Database maintenance at 13:50 reduced capacity	Maintenance window overlaps	Other services on the database unaffected	Check database metrics per client
3	Traffic spike from campaign	Traffic up 20% at 14:00	Similar spikes handled previously	Compare with prior spikes

Engineers see the reasoning and the gaps, not a verdict.

Where does it apply beyond IT?

Domain	Sources	Example
Manufacturing quality	Machine logs, material lots, quality measurements, maintenance records, shift data	A defect spike traced to a material lot and a temperature drift
Operations processes	Transaction logs, staffing, procedure changes, system changes	A rise in failed payments traced to a form change
Customer support	Ticket spikes, product changes, release notes	A complaint surge traced to a pricing display change
Supply chain	Orders, shipments, carrier events, weather	Late deliveries traced to a routing rule change

The gather-correlate-rank-draft-confirm loop is the same; the sources differ. Manufacturing context is in AI in manufacturing.

How is it evaluated?

Past incidents with confirmed causes form the golden set; the measure is whether the confirmed cause appears in the top hypotheses and at what rank. In production, track the rate at which engineers confirm the top hypothesis, time from alert to confirmed cause, and postmortem completion rates. Misses go into the golden set. The practice is in how to build a golden dataset, and the trace-based monitoring in how to build an agent trace analysis pipeline.

How does it fit incident response?

The agent starts when an incident is declared, posts the timeline and first hypotheses into the incident channel within minutes, updates as new data arrives, and drafts the postmortem when the incident closes. Responders keep command; the agent keeps the record. Postmortem structure follows AI incident postmortem template.

What does the first month look like?

The agent is connected read-only to the observability stack, the deployment pipeline, and the ticketing system, and evaluated on the last twenty incidents with known causes. It is then attached to the incident channel in shadow: it posts timelines and hypotheses, and responders note whether the top hypothesis matched what they found. After the shadow period, on-call engineers use its output directly, and every incident where the confirmed cause was not in the top three is reviewed to find the missing source or correlation. The shadow method is in how to run shadow mode deployments.

What are the common mistakes?

1. Presenting the top hypothesis as the cause.
2. No change data, so the agent guesses.
3. Write access to production systems for an analysis agent.
4. No evaluation on past incidents.
5. Ignoring the topology, so correlations are coincidences.
6. Skipping the postmortem draft, where the learning lives.

How does FISTA Solutions help?

FISTA Solutions builds root cause analysis AI agents over observability, change, and ticketing systems for IT and operations teams, evaluated on your past incidents and integrated into your incident process, through its AI enablement practice and forward deployed engineers who work alongside on-call engineers during the first incidents. FISTA has delivered 150+ projects for 50+ companies across 12+ countries with 99.9% uptime.

To shorten the hours between alert and explanation, message FISTA on WhatsApp, or read the agentic ITSM whitepaper for the wider service management picture.